add an IPermission interface

[adamfoneil]

This would bring it to Postulate parity I think

[adamfoneil]

I think it would look like this

public interface IPermissible
{
    bool AllowGet(IEnumerable<Claim> claims); // for enforcing tenant isolation
    bool AllowDelete(IEnumerable<Claim> claims);
    bool AllowSave(IEnumerable<Claims> claims);
}

And the Crud methods would need to accept IEnumerable<Claim> args

[adamfoneil]

This is part of AO.Models now in the form of IPermission -- it's not exactly as spec'd above, but gist is the same.