Authorization based on namespace, kind, readonly.

Also, pass Authorizer into master.Config.