How would the IdP ever do authz ? By (a) some new component/plugin/API or (b) by equating attributes with authorization ? Apologies for the dumb question.