What I am recommending
is an established best practice: YAGNI or perhaps KISS. When I meant something simple, I didn't mean to throw away the whole authorisation abstraction. I do consider things like role/permission based authorisation relatively simple as long as the whole logic doesn't live in a database a la
http://blog.bronto.com/wp-content/uploads/2014/10/imagecache....
