Summary

• Gateways should do coarse grained authorization

• The API can perform fine grained authorization

• Use the phatom token flow to keep PII inside the firewall

• Tokens can be shared, exchange or embedded