Most cloud systems make one authorization decision at login. Everything after runs on trust established at authentication ...