What is policy-based authorization?

Policy-based authorization expresses access rules as named policies composed of requirements and handlers. It centralizes complex rules such as role, claim, ownership, tenant, or business-condition checks instead of scattering conditionals across endpoints.