Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
Is pod restarting implemented?  I couldn't find it.
Is it decided how you will structure the URL?