a bug like this suggest that Google services infrastructure isn't based on identity propagation, and instead services have full access to other services, and a

a bug like this suggest that Google services infrastructure isn't based on identity propagation, and instead services have full access to other services, and access control and authorization checks are performed in the client service.