How would you answer an interview scenario involving policy-based authorization?

In an interview, I would first define policy-based authorization and the problem it solves, then explain how I would keep policies aligned with business capabilities, test handlers independently, pass resource context when ownership matters, fail closed, and reuse policies consistently across endpoints. I would also call out the main failure mode: creating one policy for every tiny code path without a clear authorization model can make permissions harder to understand than the original inline checks. Finally, I would describe how I would test, monitor, and safely roll back or recover the solution.