most SaaS products don't provide hooks for third-party authz, and typically you'd do authz within the service provider rather than the identity provider