Authorization game — match incoming requests to permission policies (my weekend project)