Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
What about other context around the request?  IP and time of request might be part of it too.  Basically, I'm thinking that this would be anything that we might put into an audit log.

(Also, an auditing auth provider makes sense.)