I have built something sort of similar based using purely `auth_request` and nginx. Basically, ach nginx location (ingress rule in kubernetes)s the scopes it ca

I have built something sort of similar based using purely `auth_request` and nginx. Basically, ach nginx location (ingress rule in kubernetes)s the scopes it cares about, and the request gets sent to a small webapp which checks a JWT for those scopes, logs the user and access, etc... The scopes look like github scopes, e.g. `read:resource`. So it’s more of a capabilities based system vs an RBAC one, but we have translated roles (via LDAP group membership) to capabilities to simplify things in some cases.