OP here. We use the envoy authz filter. For every incoming request envoy first calls out to a custom auth check service with all the request metadata like pat

OP here. We use the envoy authz filter. For every incoming request envoy first calls out to a custom auth check service with all the request metadata like path and http headers. The auth service can return a “fail” response which indicates to not forward the original request any further. Or it can return a “pass” response plus data to add to the original request headers. Docs here: https://www.envoyproxy.io/docs/envoy/latest/configuration/http_filters/ext_authz_filter https://www.envoyproxy.io/docs/envoy/latest/configuration/ht...