Why we built an Auth Gateway instead of putting auth in every service

If you've been on a platform team long enough, you've probably watched this slow-motion failure: You ship an auth library. Three services adopt it. Six months later, two of them are still on v1.0 , one forked it to add a custom claim, and a fourth service rolled its own because the library "didn't fit their use case." A CVE drops. Now you're hunting through repos to find every place that decodes a JWT. We've been running a multi-tenant platform on Kubernetes for a while, and we kept ending up th