A Flexible Authorization Framework