One of the things people do often with Stormpath is assign authorization policies (like XACML or plain string 'permissions', or proprietary data, whatever) to Accounts or Groups by storing them in customData.
The primary resources in Stormpath (
Tenant) allow you to store ad-hoc schemaless data in the resource's
customData for anything you need, like custom fields or of course, authorization policy information.
Accounts for example, it would be easy to first authenticate the
Account, and upon a successful authentication, obtain that account's
customData and obtain its authorization policy (e.g. XACML) and then check it however you wish.
This becomes more powerful when you do the same thing with
Group resources too.
For example, a common scheme to find an Account's effective (aggregate) policy is to aggregate all policies across all
Groups that the
Account is a member of. In this scheme, the account is authorized to do anything that is represented in its direct
customData or any of its groups'
I don't know what programming language you use, but, as an example of how this might be achieved, Stormpath users that use Apache Shiro do this exact technique with Shiro permissions, Shiro's built-in string-based authorization policy concept.
Regardless of the programming language or authorization policy format (e.g. XACML instead of permission strings), you can leverage Stormpath resources and their custom data for similar or custom authorization schemes. I hope that helps!