> I have seen the two authorization approaches get co-mingled, which leads to issues. Correct, for me this is a must avoid at all costs. I can't imagine how ha

> I have seen the two authorization approaches get co-mingled, which leads to issues. Correct, for me this is a must avoid at all costs. I can't imagine how hard / complex it is to manage / audit two authorization system. Unless your application need more detailed permission / smaller scope, example later. Personally I just use the one that comes from the identity provider. In my case, keycloak's model is sufficient for my use case. And you're right, scopes are hard and unless it's global scope, you'll need to roll your own. One good example case is github/gitlab. Global scope is the administrator access, and it's easy to set it in identity provider (as "administrator" access maybe). However for each group / repository level, you'll need to roll your own validation. EDIT: More often than not, it comes into business domain than technical / programming one. If you're not experienced with the business domain, no wonder you'll find it hard.