Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
The watch, redirect, and proxy verbs are technically GET but granularity of control for proxy is pretty important.  It should be obvious to an admin how to restrict proxy access.  Maybe an example or clarification.