Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
+1

Also what about PUT?

Also is it really useful to group things by core, cluster, or namespace? why is the latter special?