Why Policy-Based Authorization Wins for External-Facing APIs

When you open an API to the outside world, the single most consequential design decision is how you express "who is allowed to do what."