Authorization and Resource Service
Centralizing authorization so compliance stops being every service's problem.
With services touching patient data, every service that reimplements its own access checks is another place a breach can originate. In healthcare, an authorization bug is not a defect. It's a reportable event. I built a lightweight, event-driven Link Service that owns two related concerns: relationship tracking between patients and providers, and resource authorization derived from those relationships.
HIPAA also requires auditing every access attempt. I chose to publish access attempts as events to a dedicated topic rather than thread audit logging through each service, because inlining audit calls couples every service to a compliance requirement that is guaranteed to change. Services stay ignorant of the audit pipeline, and the pipeline evolves without a single service redeploying.
Compliance became infrastructure rather than a cross-cutting tax on feature code.