1. A computer-implemented method comprising: receiving, at an authorization computer system, from an application, a holder-permission object that is an instance of a holder-permission class that extends a basic permission class; receiving, at the authorization system, a permission object that is an instance of the basic permission class but not an instance of the holder-permission class, said holder-permission object specifying a resource relative to which the application is requesting to perform an operation; in response to receiving the holder-permission object, the authorization system determining whether one or more policies pertaining to the additional information are satisfied, said one or more policies specifying one or more obligations that indicate one or more requirements that the application is required to fulfill in conjunction with the application performing the operation relative to the resource; based at least in part on a determination of whether the one or more policies are satisfied, the authorization system placing, within the holder-permission object, an indication that the application is allowed to perform the operation; the authorization system placing the one or more obligations within a payload field of the holder-permission object based at least in part on a determination that the one or more policies are satisfied, said payload field being defined within the basic permission class; and returning, from the authorization system to the application, the holder-permission object containing the indication and the one or more obligations.