Why can't the "Uberproxy" (in Google terms) consume Authentication mechanisms like spiffe[1] certificates and allow access to protected resources via those?

Theres no reason a BeyondCorp architecture needs to make automation or API access harder?

[1] - https://spiffe.io/