Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
> Policy{Effect{"SKIP_AUDIT"}, Subject{Group{"secret-spy-team"}}, Verb{"*"}}

And with that, every auditor just had a heart-attack