How to organize a system of access rights?

Question

go

Tell a beginner how the system of access rights is organized in web applications?
So far, I see it this way, create a "dummy" user who will not have rights and load it by default.
Before writing a comment or performing actions of an authorized user, his rights will be checked.
There are questions about sessions and cookies.
* When a user enters the site (on any page), we check the user id in the cookie if it is not there, then it is not authorized
* If it is, we extract the id and check it in the database with the user id and return the necessary data
Total two questions.
How to distinguish between the rights of authorized users and the algorithm for working with sessions and cookies?

Answer 1

permissions2