For example, you cannot use declarative or attribute-based authorization for document ... have the requisite permission to access the resource (view, edit, delete, etc.) before being authorized.