My concern is that I am missing some key details. The use case scenarios outlined in straw man 2 include explicitly only authn use cases. This authorization service is expected to operate within a single security domain, where the owner of the resource also controls the policies at the Policy Decision Point corresponding to those resources. User authenticates to security system. Security system provides authentication assertion to user.
Application requests a check of permissions from the security server for user to access resource.
Security system decides on user's authorization and provides permission information. Application provides resource to user. Client sends a single message containing both an authentication request and a resource request, to the application. A typical example would be an HTTP request with a client certificate or HTTP Basic Auth username and password. The application sends a combined authentication and authorization request to the security system.