i think the key is having declarative policies that describe what access mean, then choosing whether to enforce inline, pre-filter, or batch filter based on latency/consistency tradeoffs