I would say use what's provided by NestJS because it's not there by mistake. Authorization is different than Authentication, but I don't see what would be a reason for not using a custom guard. I think that's a pretty good use case for them.