This authorization service is expected to operate within a single security domain, where the owner of the resource also controls the policies at the Policy Decision Point corresponding to those resources. User authenticates to security system. Security system provides authentication assertion to user. Application requests a check of permissions from the security server for user to access resource. Security system decides on user's authorization and provides permission information.
Application provides resource to user.
Client sends a single message containing both an authentication request and a resource request, to the application. A typical example would be an HTTP request with a client certificate or HTTP Basic Auth username and password. The application sends a combined authentication and authorization request to the security system. The application returns the authentication reference and the requested resource to the client. I think this is dangerously close to protocol design, which doesn't really belong in the use case document.