NOTE
Designing Authentication and Authorization
Identity proof, sessions/tokens, authorization policy, least privilege, service identity, revocation, and audit.
This is a historical learning note and may contain outdated or incomplete understanding.
Authentication answers who/what is calling; authorization answers what that principal may do to this resource.
Centralize identity protocols/key lifecycle where practical, but enforce resource authorization close to the owning service/domain. Use least privilege, short-lived credentials, explicit service identity, secure session/token storage, and auditable policy decisions.
JWT/OAuth/OIDC are building blocks, not authorization policy by themselves. Plan credential rotation, revocation/session termination, multi-tenant boundaries, and failure behavior.