Authorization
Deciding what the caller may do — role-based, attribute-based, and the object-level check whose absence is the most common serious backend vulnerability there is.
Every request carries a claim about what the caller may do. The backend is the only place that claim can be tested.
"Who are you" and "may you do this" are different questions with different answers, different failure modes and different blast radii.
A hidden button is not a control. Middleware, handler, service and query each enforce something different — and only one of them is a guarantee.
Roles group permissions so people can be granted a job, not a list. What roles cannot express is anything about the object.
Rules over attributes of the principal, the resource and the context — more expressive than roles, and correspondingly harder to reason about.
A user can be perfectly authenticated, hold exactly the right role, and still have no business touching project 123.
One deployment serving many customers, where the worst possible bug is showing one of them another one's data.
The tenant comes from the authenticated principal. Any other source — header, subdomain, path, body — is an authorization bypass with extra steps.