First-party RS256 identity
The authentication service issues asymmetric JWTs and a shared package gives every service one verification path without distributing the private key.
Trade-off: The team owns key rotation and authentication operations, but authorization behavior remains inspectable in the same codebase.


