Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
If there's a way to clearly communicate group information with a user such that the policy engine can express it, that could also satisfy the need here.  I do think organizations expect to perform policy on groups, so we want to have a clear example of how to do that.