Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
Do we need to deal with group here at all?  Could it be that for the auth module system to be group aware/based it has to have a back channel to the group definition system?  Or perhaps we consider group to be a feature of the auth system and not the identity system.  It surprised me to see group here.