Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
ah-- it's a danger rating? That makes sense, but I don't think those are intuitive names.