Admission control proposal

I am starting to look at how I can support some features that will require admission control, so wanted to get high-level agreement on the strategy so I can look to work on some of the more specific use cases we want to use admission control to achieve.

Feedback appreciated.
I'd been considering the ability to run a privileged container to be part of Authorization.