Where I work client auth is used for a good (and growing) number of internal services.

Client auth is simple to use - our internal services are given the username from the CN, which they use to perform authorization checks. For a lot of simple internal services that don't require two-factor auth it works great.

Am I missing something better?

(We already have the infrastructure in place to deal with client keys)