>> How do you get this kind of explainability when the authorization decision involves such advanced magic as logic programming languages?

You could do this by generating a trace of the execution of the logic program, as you run the program. For example you can write:

  allow(update, Resource, User, Reason):- 
    Reason = owner(Resource, User)
   ,Reason.

Although that is probably not very idiomatic datalog. That is, I don't know if you can "call" a literal bound to a variable like I do in the last line of the program by declaring "Reason" after binding Reason to "owner(Resource, User)". If you do that in Prolog, the Prolog engine will prove the literal bound to "Reason" and execute the "owner" program. I don't know if that works in datalog. You can of course do all this without call-magic:

  allow(update, Resource, User, Reason):- 
     owner(Resource, User)
    ,Reason = owner(Resource, User).

Historically, mechanisms of explanation very similar to the one above were common in expert systems of old, at least the ones implemented in Prolog. There used to be a nice free e-book describing how to build expert systems in Prolog in a quick-and-dirty fashion, but I can't find it online anymore. There's this book by Amzi Prolog though:

https://amzi.com/distribution/files/xsip_book.pdf

And this has a section on "Explanation" that describes a tracing mechanism based on the classic box-model debugger of Prolog engines. The technique can be applied to datalog and the program doesn't have to be an expert system, just to make it clear.