1. A method comprising: initializing an authorization policy store to maintain an application object that represents an application; associating with the application object an operation object that represents an operation that can be performed using the application; associating with the application object an application group object that represents a user that can be granted access to the application; and associating a role object with the operation object and the application group object to represent authorization for the user to perform the operation.