I read that as "request authentication", i.e. some way to sign or HMAC the content of the request, with keys given only to the things that need to interact with the service.

If users are involved, then yeah you also need some kind of RBAC for it to make any sense.