Coarse‑Grained Authorization via Access Levels and JWT Bitmaps

The article explains a lightweight authorization model where roles are collections of coarse access levels, and endpoints declare which access levels are required. The Auth Service consumes an access_levels.json file shipped by each product service to a known S3 path; no gateway deploy is needed to update permissions. JWTs carry a compact bitmap of granted access levels and a registry version number. The gateway uses the bitmap when the registry version matches; otherwise it falls back to string matching. This design keeps token size small (down from ~3 KB) and allows rapid permission changes without redeploying the gateway. The CI/CD pipeline automatically uploads the updated JSON to S3 on merge, and the gateway refreshes on its next cycle.

This approach separates policy definition (by product teams) from enforcement (by the gateway), enabling auditability, rollback via git, and minimal operational risk. The article also highlights the importance of keeping the bitmap stable and versioned to avoid mismatches.

Overall, the strategy provides a scalable, maintainable authorization layer that can evolve with product changes while keeping the gateway stateless and fast.