If it’s fine, you can consider yourself lucky. Authentication and authorization complexity is IME squarely proportional to system and organization size due to network effects inside them. At some point it becomes a significant subsystem in itself and contrary to belief of some it becomes a core business problem, not a checkbox to tick off.