If a service is only reachable on a private VPC, that is network isolation — not authorization.

A misrouted request, a compromised host, a future public exposure, or someone testing with curl can still hit that endpoint. Treat every request as untrusted until you check who the caller is and what they may do.

Separate the layers:

• Network controls shrink the blast radius
• Authentication answers who is calling
• Authorization answers whether that caller may perform this action on this resource

Do not skip the last step because the first one feels safe.