General-purpose policy engine for unified authorization across the stack. Uses Rego policy language to define fine-grained access control decisions.