The session ID is a claim check; the real identity stays in the server's cloakroom.
Authentication proves WHO you are; authorization decides WHAT you may do.
RBAC decides by your role; ABAC decides by the full context of who, what, where, and when.
The token carries the identity inside itself, signed by the server, so any server can trust it without looking anything up.