Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
Fine with adding that context.

One small advantage of doing audit after authorization is that you can write policy about which actions should be audited: e.g.:

Policy{Effect{"SKIP_AUDIT"}, Subject{Group{"secret-spy-team"}}, Verb{"*"}}