Ok. I feel like we need a handful of examples of policies adopters would want to have, at least hypothetically, so that we can feel whether the API is going to meet those needs.

Working the "logging in to some services requires authenticating in multiple simultaneous ways, while logging in to other services does not" example: What's the design intention on how such a policy would be implemented?  isSatisfied() implementation that considers the service?  It doesn't look to me like the parameters to isSatisfied() are sufficient -- Authentication e.g. doesn't convey the target service.  

So: richer inputs to isSatisfied() ?  Move policy evaluation elsewhere rather than it being the responsibility of AuthenticationManager?  Something else selects a desired AuthenticationManager depending on the factors that AuthenticationManager can't itself consider?