> It sure sounds like it, but no - it works, it's easy, and it's super safe. The "trick" is that it's frontend-only in the same sense that Serverless has no servers. There is a backend component which actually enforces the access, you just don't have to build it - FoAz is a generic backend component leveraging policy as code together with a reverse-proxy, and secrets management services to produce a one size fits all backend authorization.<p>Phew. I was about to blow a gasket.<p>So, this approach works, but generally either you build a lot of knowledge of apps' resources (URI local-parts and q-params semantics) or you have very coarse-grained authz or you restructure your applications so that a minimal authz language can represent a lot of what you're doing using only URI local-parts.