Ah, ok. Do you think it would work okay with a distributed setup, with different apps on different servers, and so on? I'm imagining lots of RPC calls just for authorization. (Like, if the apps do defensive role checking.)