Is this idea fine for implementation of RBAC

[xyzwlkj]

Hello everyone, I am newer to Kong Gateway with Kubernetes, I have an idea for implementation of RBAC.

When the client request to Kong, then Kong verify the JWT, if pass, then Kong request to upstream of UPMS(User Permission Management System) service to check this URI , if this user has permission, then UPMS return true to the Kong, then Kong pass the request to the inner target upstream service, otherwise Kong simply return "No Permission" message to the client.

The UPMS permission rules will be dynamic CURD in WebApp.

My Question: Is it possible to request upstreams in sequence? And is it a bad experience(cause Thread&Process lock while request) for production to implement this outside Kong ?

I am ready write a lua plugin to implement it. Thank you for your reply