See this post at https://research.nccgroup.com/2020/04/21/code-patterns-for-api-authorization-designing-for-security/