Episode goal: give the viewer a decision framework for policy placement, and the “defence in depth” intuition, before revealing Chenile’s unified answer next episode.
Cold open
On camera: “A request crosses two very different places on its way to your business logic. Where a policy runs changes what it can do.”
On screen
A pipe from client → API gateway → several services, each with a last-mile pipeline. Label the two checkpoints clearly.
Gateway strengths
Voiceover: “The gateway sees traffic before it fans out. That makes it perfect for early, coarse, high-leverage policies: authentication, rate-limiting, coarse ‘can this caller reach this API family?’, request normalization. Its superpower is leverage — one config protects everything behind it.”
Gateway limit
“But the gateway has no domain context. It doesn’t know this order belongs to that tenant, or that a user may edit only their own records.”
Last-mile strengths
Voiceover: “The last mile runs inside the service, where the model and the data live. That’s where context-rich policies belong: fine-grained authorization, multi-tenancy, idempotency, business-aware logging and i18n. Its superpower is context.”
Last-mile limit
“But a last-mile-only policy does nothing for traffic the service never should have received. Reach is the trade.”
The rule of thumb
Lower third: “Decidable from the request alone? → gateway. Needs the resource? → last mile.”
Both
Voiceover: “Real systems do both. Authenticate at the edge to keep junk out cheaply; authorize the specific resource at the last mile so it’s safe even if traffic arrives another way — an internal call, a message, a future gateway. That redundancy is defence in depth, not waste.”
The catch
“Here’s why teams don’t do this cleanly: the gateway and the service are usually different tech and different programming models. So you write authorization twice, in two styles — and they drift.”
Cliffhanger
“What if the same policy could run in both places, and configuration decided where? That’s the next episode.”
Recap card
“Gateway = leverage, no context. Last mile = context, limited reach. Serious systems use both.”
Companion reading: Where policies live: the API gateway and the last mile