See my toplevel post.  Our customers love using `access_by_lua` to delegate authentication and authorization to our service.  Obviously you can use your own authorization and and access control to accomplish the same thing, in the same way.