I think its a service that acts as your roles table. So your service would query warrant with a user and an action and it would return whether that's authorized? I'm also a bit confused why someone wouldn't use something like Ory[0] at any scale where modularizing this out was important.