For authentication (authn) it's quite easy, and in production we do have a separate authn daemon. For authorization (authz) it's IMHO a bit better to handle it

For authentication (authn) it's quite easy, and in production we do have a separate authn daemon. For authorization (authz) it's IMHO a bit better to handle it in the DB level, similar with Firebase's ACL lists.