title: How to authorize user to access to resource based on OR rules
body: <h2>Scenario:</h2>
  
  <p>I have complex WebApi application. In controllers I want to authorize user to access specified resource based on following business rule:</p>
  
  <p>In order to access a resource, User must</p>
  
  <ul>
  <li>be <strong>Authenticated</strong></li>
  </ul>
  
  <p>AND</p>
  
  <ul>
  <li>be <strong>Author</strong> of the resource OR be <strong>Sponsor</strong> of the resource OR be in Admin role</li>
  </ul>
  
  <p>AND 
  - other rules based on type of resource and action</p>
  
  <h2>Question:</h2>
  
  <p>How to organize and configure Policies, Requirements and RequirementHandlers to meet this rule (with OR conditions)? </p>
  
  <p>I know the authorization API was designed so that it can handle any scenario, but I need strategy so that it is maintainable and readable in complex and evolving scenarios.</p>
  
  <hr>
  
  <h3>Here is my initial attempt:</h3>
  
  <ul>
  <li>I have created <code>IsAuthorRequirement</code> and generic handler, that can handle this requirement for all resources.</li>
  <li>I have <code>IsSponsorRequirement</code> and multiple handlers, since each resource type has to be handled differently.</li>
  </ul>
  
  <p>My initial thoughts were create custom policy for each Resource and Action, e.g.:</p>
  
  <ul>
  <li>CanReadResource1Policy</li>
  <li>CanEditResouce1Policy</li>
  <li>CanReadResouce2Policy</li>
  <li>CanEditResource2Policy</li>
  </ul>
  
  <p>In other words, policy per permission. </p>
  
  <pre><code>public async Task&lt;ActionResult&gt; GetById(int id)
  {
     var resource = _dbContext.Resources1.Find(id);
  
     var authResult = await _authorizationService.AuthorizeAsync(User, resource, Policies.CanReadResouce1);
     if (!authResult.Succeeded) return Forbid();
  }
  </code></pre>
  
  <p>But now I feel I'm somewhat fighting the framework and I that misused policies/requirement. For example, by default policy requires all requirements to succeed, but my business rules has OR condition. I know multiple requirement handlers creates de facto OR condition, but should I use this to create the OR condition in my buseness rule?</p>