Ideally, we would lose the notion of “authorization” and only retain “authentication”, with respect to a network of autonomous systems.
Authorization really only makes sense in the context of command and control (i.e. getting someone to do something that you want, and getting them to stop doing something that you don’t want).
But (as you know), the Internet operates by negotiation, where autonomous components adjust their goals (and sub-goals) based on their best understanding of the environment. Components don’t exchange commands, just information, and they make their decisions based on not only on the content of a message, but also its provenance. Thus, fraud is the actual impeachable act, since what we really care about is the authenticity of a message.
Admittedly, this regime does not allow for the prosecution of something like a SQL-injection attack (though it probably could be stretched to do so); but ideally, SQL-injection vulnerabilities would almost always be treated as negligence.
Of course, we all know that the world is not ideal and compromise is necessary (it would be ironic for me to suggest otherwise), but it would be nice to do the experiment.
(Yes, this is just recapitulating the arguments for capability-based security)
(On the other hand, while the Internet is not a command-and-control environment, it probably needs one on a meta-level.)