[erikerikson]

I think the webhook producer tends to implement auth in both scenarios but agree that the webhook consumer executes auth in the webhook case. You perhaps meant this but I was initially confused by what you were trying to say here. You other comment was far more helpful, thank you for making it.

In summary of my other comment, it is the case that the implementation and execution roles are the same but the threat surface is very different.