Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
Given our now settled definition of Name, and the previous document about access, is this the name of the user (unchanging and unique, human readable)?  If so we may want to clarify that this is a User Name which is expected to be unique per user, stable, and add the caveat that this value could change to represent a different actual user in the future.