You put a lot of work into authentication. A gateway validates the Keycloak JWT, maps realm roles to authorities, checks that the caller is allowed. By the time a request reaches your service, you know exactly who is calling.
Source: [Dev.to](https://dev.to/ramesh-yara/who-did-this-identity-across-async-boundaries-1n4n)