Does that negate all the benefits though? If a single component of your application maintains a little state, say the API Gateway, and all the downstream servi

Does that negate all the benefits though? If a single component of your application maintains a little state, say the API Gateway, and all the downstream services simply get a clean JWT they can trust with all the right claims in it? I'm thinking this is still nicer than having every downstream service also having to check auth claims against some datastore.