How were authentication and authorization organized for the public service? Was there a separate authorization service, how did it interact with other services, and who accessed it: frontend, users, or backend services?