Who Decides? Policy-Based Authorization for Government APIs

This is the fifth post in my series on Germany’s federal API authorization blueprint. The last four posts got a verified, sender-constrained client all the way up to the door of an API. Today is about the question that starts the moment it arrives: who decides what it is allowed to do — and where that decision lives.