This example is weak. Checking if the record already has this tag is not an authorization concern, it's business logic. Yes, I shouldn't be able to remove a tag that does not exist, but not because I could ever *gain* this ability. There is no possible case where someone else *should* be able to do this. Authorization should be solely for the purpose of who is allowed to do what. Adding in stuff like this which can easily be determined to *always* be applicable to *everyone* does not make sense.

Consider this: could there ever be a scenario where an admin would be allowed to remove a tag that doesn't exist? Obviously no, because that does not make any sense.

In a lot of our applications we have stuff like this creeping into authorization, and it quickly escalates and makes authorization completely unmanageable.

So once we skip that part, we no longer have a cause to send in the `tag`.

Aside from all of this, we could have just created a policy for the join model instead, so if we have a `TaggingPolicy` we would have access to both the `post` and the `tag` and we could have verified both of these things, thus there wouldn't have been a need to pass in extra arguments. I think this is what pretty much every case of wanting extra arguments boils down to. Convince me that there is something which *cannot* be covered simply by choosing the correct object to write a policy for.