This resonates to me. In my last job we didn't plan our authZ story very well (or at all!). As our company experienced explosive growth, we ended up implementing something that I suspect is pretty common: AuthZ policy as data because we ended up representing it in a postgres db, and policy as code because we then had to write an "engine" to interpret that data. There were none of these emerging cloud authZ solutions, having one might have saved us a lot of time and grief!