Inside the Auth Service: From Token Validator to Policy Decision Point

Most auth services start simple — verify the token, return 200 or 401. Then requirements accumulate. Tenant isolation. Service accounts. Token revocation. Access levels per endpoint. And suddenly what was a lightweight validator is carrying a lot of weight, without a clear structure to hold it. This post is about how we structured ours — the ideas that shaped it, and the ones we got wrong before landing here. One job, lots of supporting infrastructure The Auth Service does exactly one thing from