The Policy plug-in aggregates policies and rules to determine whether a user is authorized to access a protected resource.
