I have multiple microservices where I authenticate them via a gateway. After the gateway authentication, I call an authorization service before any API which retrieves the d