Sidecar Authorization
Running a local authorization engine alongside each service instance — reached over `localhost` — so every request is checked without a network hop to a central decision service.
aka: ext_authz, sidecar pattern
The sidecar pattern trades a shared central PDP for a local one riding alongside each service — an Envoy ext_authz filter calling an OPA instance over localhost is the canonical example. It removes the network hop and the single point of failure, at the cost of policy now being distributed across every sidecar, which is what makes policy bundle distribution the real problem this pattern creates.