End User, Security Group (JWT etc), to the Front End application, Proxy (nginx), to the API Gateway where policies are applied (Security, Throttling), to the API (Docker, K8s), Back End Data Access.
