Nothing wrong about keeping a monolith if it doesn't get in the way. At my clients, the typical case is that the "product" consist of an assembly of services w

Nothing wrong about keeping a monolith if it doesn't get in the way. At my clients, the typical case is that the "product" consist of an assembly of services where some have been written and some bought so being able to span homogenous access controlls over them is a nice feature of JWTs/OIDC :-)