Implement Permissions checks into Core

I may have missed some spots...
What are your thoughts on having this in the app's permission namespace vs the core namespace (like core.application.authorize.<app>)? My instinct would be to prefer the latter