In Chapter 3 the controller branched on something called the "endpoint type": switch endpointType ( perms ) { case "OPEN" : ... case "AUTHENTICATED" : ... case "ACCESS_CONTROLLED" : ... } Enter fullscreen mode Exit fullscreen mode That branch is the most important conditional in the entire gateway. It decides whether a request even gets a token check, and whether to run authorization. This chapter is about how that decision is data , not code, and the trie that powers it. Three kinds of endpoint Every endpoint in our platform falls into one of three buckets: OPEN — no auth required at all. Health checks, public OAuth callbacks, JWKS, version, docs. The request is allowed without a token. AUTHENTICATED — token required, no specific permission. "Get my own profile," logout, list-my-stuff endpoints. Anyone with a valid token can call it. ACCESS_CONTROLLED — token required and a specific permission. Admin operations, deletes, anything that crosses a user boundary.…