I\'m trying to use policy-based and resource-based authorization. Let\'s say I have employees, and those employees have specialties and services, and of course bosses.