1. A computer-implemented method comprising: receiving, at an authorization system, from an application, a holder-permission object that is an instance of a holder-permission class that extends a basic permission class; wherein the holder-permission object specifies a resource relative to which the application is requesting to perform an operation; wherein the holder-permission object specifies additional information in a payload field of the holder-permission object; wherein the payload field is defined within the basic permission class; in response to receiving the holder-permission object, the authorization system determining whether one or more policies pertaining to the additional information are satisfied; based at least in part on a determination of whether the one or more policies are satisfied by the additional information, the authorization system placing, within the holder-permission object, an indication of whether the application is allowed to perform the operation; and returning, from the authorization system to the application, the holder-permission object containing the indication.