The Case Against Token-Based Authorization
cerbos.dev