And then you use a "function" behind the gateway for the parts that need to write or need to see things that need authentication. Just like in the diagram...? Nothing says that you can only allow public access to a database.