Implement a Policy language for Authorization