The Route Table Is the Contract: Claim Checks Behind a Gateway

Recently I helped a team where several services all needed to read documents that another service wrote to an S3 bucket. We wanted to keep the object store, the bucket layout, and the IAM permissions independent from the consumers, so the owning team could change any of them without asking anyone else&rsquo;s permission. The first pass was the obvious one: a shared library that wrapped the details…