The common assumption about access control in APIs is to cover the introductory auth phase as part of the API gateways and let the application code cover the advanced authorization and permission management. In the modern stacks of APIs, however, applications are usually decentralized and disconnected from each other while the APIs in the product serve all needs together. The old authorization assumption can lead to implementation and efficiency problems in access control. This talk will discuss decoupling policy and permissions from application code, using open-source tools for decentralized but unified policy solutions, and running sidecars to handle permissions efficiently. We will build a demo product that proxied API calls and do an advanced authorization in the phase it should be, the API gateway.