> But authorization is rather tightly coupled to your service, and outsourcing that part would be much more of a challenge -- keeping authorization rules up-to-date with external systems is a difficult dependency management problem.

Strong agree. We're trying to strike the right balance with this problem with oso [1] (I'm a cofounder). By letting you separate the authorization logic from your code, and doing a lot of the thinking for you (how to design + implement roles etc), but ultimately the data *stays in the application*. There's such a blurry line between authZ and business logic that it doesn't make sense to fully outsource it.

[1]: https://www.osohq.com/