It's amazing how much work these days goes into re-inventing RPC.
HTTP API's, whether using JSON as the data encoding or not, is basically RPC. Celery is decentralized RPC. AMQP is decentralized, unreliable RPC.
It's even a buzzword: microservices are basically "let's use RPC as much as possible".
Anything highly-distributed evolves towards explicit message passing, which is basically... yep, RPC.
You would think we'd have come up with a semi-reasonable general solution by now.
The thing is authentication isn't even hard: you have a central authority users register with, that authority that publishes public keys for anyone to look at, and *one way or another* users manage the private keys attached to them. Nobody needs to give a damn how the private keys work as long as it's convenient and secure. Then users just sign messages to prove their origin and anyone receiving the message can verify it.
Instead we have OAuth, which nobody can even explain sensibly.
Anyway, authorization is the other part of the auth/auth puzzle but by its nature every different service will have to be able to define what it means to them, so it's not a problem that needs interoperability.
You can complain about central authorities but there's no reason running one of these key authorities should be any harder than running a DNS server, so it can be as decentralized as you want (distributed is harder; it should be possible, but it's a research project. Decentralized is entirely possible with 1980's technology; see fgure). https://octodon.social/media/ZiBMrqBg7jp6hq6m3wE