Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
might be better to model this as two authorizations? Like first, can you read the template, and second, can you create the pod?