uthorization decision is completely done locally inside an Envoy filter, without dependency to any external module.
This allows Istio authorization to achieve high performance and availability.</p><h3 id=work-withwithout-primary-identities>Work with/without primary identities</h3><p>Like any other RBAC system, Istio authorization is identity aware. In Istio authorization policy, there is a primary
identity called <code>user</code>, which represents the principal of the client.</p><p>In addition to the prima