You can implement your own authorization mechanism in an extension.