1. A computer-readable storage medium whose contents cause a computer to: receive an authorization query regarding a request to access a resource; identify a principal requesting to access the resource; perform an access control check to determine whether to deny authorization to access the resource, the access control check being based on the principal and a policy applicable to the principal, wherein the policy is maintained as part of a centralized policy store and the policy comprises one or more rules; and responsive to determining to deny authorization to access the resource, return a deny decision denying authorization to access the resource, and enter an entry into an audit log, the entry recording the denial of authorization, such that the computer instructions are executed as an integral component of an operating system suitable for executing on the computer.