How should policy-based authorization be designed for production?

For production, keep policies aligned with business capabilities, test handlers independently, pass resource context when ownership matters, fail closed, and reuse policies consistently across endpoints. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.