`Policy#authorises()` implemented, documented, tested