mTLS (and client certificates) are great at authentication for service-to-service calls: you learn which caller is on the wire.

That is not authorization.

A trusted billing-worker identity still must not delete invoices, export another tenant's PII, or hit admin-only routes just because the TLS handshake succeeded. Treat the verified service identity as the subject, then check action + resource (+ tenant) the same way you would for a user.

Otherwise every compromised or overly-broad service account becomes a skeleton key.