Quick Answer
Authorization: after authentication, check what the user can do. Options: RBAC (role-based, attach roles to users, check role permissions), ABAC (attribute-based, more granular, check user attributes against resource attributes), or OPA (Open Policy Agent, centralized policy engine that services query). Don't rely only on the gateway - enforce authorization in each service.
Answer
Authorization uses role-based or permission-based access control. Tokens contain claims defining user privileges. Can be enforced at API Gateway level or per microservice for fine-grained rules.
S
SugharaIQ Editorial Team
Verified Answer
This answer has been peer-reviewed by industry experts holding senior engineering roles to ensure technical accuracy and relevance for modern interview standards.
