RE the bundles, I assume you mean that the calling application can just bulk write tuples and caveats such that you don't need to define the set of tuples/caveats in the authz db?