1. A method implemented by an authorization management system to determine, based on data stored in a role-based authorization policy store, whether a user is authorized to perform a requested operation of an application, the method comprising: receiving an authorization request comprising: an operation identifier that indicates the requested operation; and a scope identifier that indicates a scope of the application, wherein: the scope of the application represents a collection of operations associated with the application; the collection includes less than all of the operations associated with the application; and the requested operation is associated with the indicated scope of the application; identifying in the authorization policy store, an application object that represents the application, wherein the authorization policy store comprises an object-based hierarchical data structure, comprising: an application object that represents the application; an application group object that represents a group of users; a scope object that represents a collection of objects that together represent a portion, less than the whole, of the application; an operation object that represents a particular operation available in the application; a task object that represents a collection of operations available in the application; and a role object that represents a relationship between users and operations; wherein: an application group object is not a parent object to any other objects; a task object is not a parent object to any other objects; and a role object is not a parent object to any other objects; identifying, in the authorization policy store, a scope object that, according to the object-based hierarchical data structure, is a child object of the application object and that represents the scope of the application indicated by the scope identifier; identifying a role object that, according to the object-based hierarchical data structure, is a child object of the scope object, wherein the role object comprises a members attribute that identifies one or more entities that are members of the role; determining whether the user is represented by any one of the one or more entities that are members of the role; in an event that the user is represented by at least one of the one or more entities that are members of the role, determining that the user is authorized to perform the requested operation of the application; and in an event that the user is not represented by at least one of the one or more entities that are members of the role, determining that the user is not authorized to perform the requested operation of the application.