Rework the identity and authorization pattern drafts before publishing

The six pattern drafts in cheatsheets_draft/ by @dadrus (thank you for the series, it fills a real gap) had a full review on 2026-09-27 before promotion. Summary per sheet, with the fixes needed to move each into cheatsheets/.

Cross-cutting, all sheets

• Add ## Introduction; give every H2 at least one inline https:// citation (CI enforces this on every H2 of a moved file); replace italic cross-references with real relative links, and only to published sheets; export the draw.io SVGs to PNG under assets/; end each sheet with a short recommendation rather than a neutral list of options.
• Publishing order: Authentication Patterns (PR in progress), then Identity Propagation, then Authorization Patterns as the hub, then the merged distribution sheet, then Decisions and Output Handling.

Identity Propagation Patterns

Close to ready. Restates about 30 lines of the Microservices Security sheet's External Entity Identity Propagation section without linking it: trim that section to a summary plus link in the same PR. Fix "Secure Token Service" to "Security Token Service" (RFC 8693), move Transaction Tokens to the protocol-agnostic pattern (the ingress obtains one Txn-Token and passes it unmodified), rewrite the "unsuitable for Zero Trust" con on the forwarding pattern (the real issues are audience and blast radius), fix the broken bullet at line 26, cite the privacy section and soften the GDPR wording, collapse the four repeated "verification depends on token type" paragraphs.

Authorization Patterns

Needs major work. Duplicates the Microservices sheet's edge-level and service-level patterns without linking it; 4 of 5 sections have no citation; a blog leftover at line 136 ("the next blog post"); line 33 inverts time to market; the PDP table lists OPA, OpenFGA, and SpiceDB as NGAC examples (none are) and pins products to deployment modes; the "Edge-Level (Modern)" section has no source and omits that downstream services must verify the propagated signed context and reject direct calls. When fixed, it should replace those Microservices sections, which then link to it.

Authorization Policy Dimensions and Authorization Data Dimensions

Merge into one "Authorization Policy and Data Distribution" sheet. They are two halves of one blog section with near-identical strategy text and parallel tables, and one citation between them. In the merge: fix the quick-reference row that maps centrally owned policies to delayed embedded distribution (central security policies need immediate propagation), add distribution-channel integrity (signed bundles, version pinning, fail behavior when the policy server is unreachable), add "the PDP authenticates PEPs, never trusts end-user-supplied attributes, and protects its data API", drop the unused Locality section, and give the merged file the _Cheat_Sheet.md suffix.

Authorization Decisions and Output Handling

Keep as its own sheet, it covers ground no published sheet does (authorized data sets, authorization filters, batching), but it needs major work: fail-open is presented as a neutral option (a PDP outage must fail closed; link Deny by Default in the Authorization sheet); add a Security Considerations section (apply the returned filter on every read path, AND it with the application's own predicates, bind filter values as parameters, treat a truncated ID list as incomplete); cut the performance sections to one paragraph; fix "und" and the false claim that ReBAC and NGAC PDPs cannot return filters at all; cite AuthZEN 1.0, OpenFGA ListObjects, Cerbos PlanResources, and the OPA Compile API; rename the file with the _Cheat_Sheet.md suffix.

@dadrus would you be up for reworking these along those lines, one PR per sheet? @mackowski FYI. Happy to answer questions here.