Determines whether or not an actor can take an action on a resource, based on a combination of authorization data and policy logic.