Provider agnostic policy enforcement point for authorization