I'd be tempted to push this to the Authz API as I think it's something that the Authz service should own and content hosting should use in the this case.