This is a great example of why zero-trust is more about enforcing trust boundaries than adding authentication everywhere.

One pattern I've seen work well is keeping services completely unaware of JWTs and identity providers. Let the gateway authenticate, let the service mesh validate and project identity, and let the application focus purely on business logic. That separation makes services easier to test, swap, and secure without duplicating auth logic across every microservice.

The database identity propagation and RLS integration were especially interesting they close the loop so identity isn't lost after the request reaches the backend.