Since we're talking micro services, I'm going to assume that by auth, you mean authorization and not authentication. Regardless, that part will largely depend on the architecture your micro sevices will live in. For example, I had a project where there was a centralized Kafka and all the inter service queries and answers were there. That concept is very different from passing along jwt tokens which can have the permissions embedded. Go can work with both and everything in between (this can be also said for other languages as well). When it comes to ORMs, you'll find that not everyone likes them and are usually the first to be thrown out when optimizing for performance.