That assumes you have complete trust and confidence in the integrity and security of every single process running within your internal network.<p>I personally prefer to maintain a &quot;need to know&quot; approach to communication between all systems on my network (including services, databases, infrastructure).<p>This means that, for example, if my public-facing vehicle lookup service is compromised, my users&#x27; data is still a long way away. This is enforced by: (1) not providing an address to the service, (2) not providing the keys&#x2F;passwords required to authenticate with the service.<p>Not doing authorization internally means that the moment a single process running on your network is compromised (which almost certainly is possible), your attacker now has access to the entirety of your system, and you&#x27;re fucked.<p>Also, the overheads <i>can</i> be extremely low - to the point that they&#x27;re not noticeable. It just depends how you do it.