Framework for constructing role-based authorization subsystems