posix_monad

Services often need to talk to each-other, but how should they control access?

In an ideal world, callers can prove who they are to services and services only grant access to a minimal set of consumers. There should be low boiler-plate for maintaining service identities and things like token revocation, secret rotation, etc. should be "easy". Bonus points for avoiding vendor lock-in.

What approach do you use for securing service-to-service access?