One PDP
Every service asks the same policy decision point and none computes its own answer. It is occasionally inconvenient and always correct: there is exactly one place where "may they" is decided, so there is exactly one place to audit, change and reason about.
A lint rule fails the build if a function so much as looks like a local permission check.