I'm of the opinion that using an abstraction without some knowledge of the underlying implementation is dangerous, especially when it deals with security.  This is an educational attempt to learn the fundamentals of writing an authorization system.  Hopefully, it will help me to make more informed decisions about 3rd party systems going forward.  I don't recommend anyone use this for anything other than educational purposes.