Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
So, I'll split this document into a "Authorization Plugin Architecture" doc and a "Attribute-Based Authentication Plugin Design" doc?