Comment by throwaway3306a

> but the idea of trying to apply a permission/access control layer is nightmare material.

In your case of many disparate services, the nightmare is just the same with REST.