Moving this logic back up to the application tier means that applications may be inconsistent wrt who can change authorization. I would think the authorization service (which this is the closest thing to) should decide who can use it (encapsulation of functionality).