Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
If this is a go design and not a serializable API object design, this should be an interface implemented by both user and group.