The service that trusted its caller's word
The edge authenticates the user properly. Behind it, the orders service learns who the request is for by reading a header the gateway sets — a plain string, believed on arrival.
That works exactly as long as nothing else can reach the orders service. Any component inside the network that can open a connection to it can also claim to be any user, because claiming is all the header ever was.
Outside every boundary: Orders service (internal only; FAILED: believes a header), End user (signs in once), Edge gateway (authenticates), an empty slot for the proves whose behalf, an empty slot for the proves which caller Connections: End user calls Edge gateway (step 1) Edge gateway calls Orders service — internal call (step 2) proves whose behalf controls Orders service proves which caller controls Orders service