[npwr]

Authentication should definitely not be coupled with authorization. The only link between the two is an user ID.

AWS very much decoupled authentication from authorization with Cognito and it works very well.