A general-purpose policy engine used to decouple authorization and compliance logic from application code.