Yeah I assume most apps are still single SQL user so auth is code-managed while data lakes are better as native.

So my q is modern arch for the app code services -- like, authenticate via JWT and pass that around, maybe even through internal requests, but where does the authorization logic go? A middle tier REST microservice that does all SQL queries, like a graphql layer? (And then DIY RBAC wrappers over the graphql?)