I think this glosses on a very important part, which is just named in passing: "how do you actually know that bob is bob, and how do you trust that?"

article answer is 'user role [..] attached to a JWT' but that only really applies if you control your distributed microservice system, if you need to scale to etherogeneus identities you need to get into the magic world of federated authorities

and that is where the pain really is.