s/auth/authz/ to be more specific
Split core into core and extension
Start basic testing
s/check_permission/is_permission_in_state/

It is clearer.
Move parse_state into own module (and test)
ACLs are really the "core", so merge name it so!