mTLS encrypts traffic and authenticates both sides (service identity), which helps prevent impersonation and sniffing. It does NOT solve authorization by itself (what a service is allowed to do), and it doesn’t replace input validation or business-level security rules.
Expanding on the short answer — what usually matters in practice:
A tiny example (an explanation template):
// Example: discuss trade-offs for "mtls-between-services:-what-does-it-protect-and-"
function explain() {
// Start from the core idea:
// mTLS encrypts traffic and authenticates both sides (service identity), which helps prevent
}