I know the answer is "it depends" but I still want at least some basic advice here: in a microservices architecture with a gateway, should the gateway use Cerbos to authorize requests, or should microservices use Cerbos to authorize requests?

Typically speaking it would be done in the microservices. The gateway has the details of the principal (user) but it likely doesn't have the full details of the resources they are trying to access, and you need both to form the call to Cerbos. In some cases it might be possible to do at least some high-level authorization at the gateway level, and then more fine-grained checks from the microservices, but it's probably simpler to start out with just doing authentication in the gateway and leaving authorization to the microservices.

Got it 👍 That's kind of what I was thinking but wanted to make sure my hunch is correct Thanks!