Today the XR wires up everything around the function and trusts you to have made the function. Next, the XR makes the function too, and that is where the architects' and security team's rules get to live.
Shipped small
Bring your own function let the first cloud targets land in two days, with no cloud credentials held by the control plane.
Tested end to end
Lambda, Azure Functions and every cloud target have run end to end. The gap that is left, composing the cloud resource, is written down, not hidden.
Same contract
When the XR starts composing the function, the request does not change. That is the point of putting an API in front.