Comment by jayd16

Services handle the permissions of their own features. Authentication is handled at the gateway.

Not sure if I agree its really the best way to do things but it can be done.