Authentication proves who someone is. Authorization decides what they can do. Those are different moments, and they do not travel together forever.

After a user crosses a trust boundary — a new service, a webhook handler, a background job, a different API gateway — re-check the permission for that action on that resource. A JWT that said "admin" at the edge is not a free pass deep inside your system.

Treat each hop as untrusted until your policy says otherwise. That habit catches broken assumptions when services are reused, messages are replayed, or callers change.