You're not wrong, it's one of the most difficult parts and definitely something we're trying to solve with Nitric. Here is the overview doc about how we handle this problem https://nitric.io/docs/reference/access-control would love your feedback.