Need doc on authorization policy

[linsun]

This is very tricky to get it right for ambient, I expect the doc to cover:

L4 authz policy L7 authz policy Strategy moving from L4 authz policy to L7 authz policy Various scenarios on if authz policy is enforces:

• with waypoint or without
• use workload selector or targetRef(s)
• client is out of mesh or sidecar or ingress gw.
• does destination ztunnel always trust the destination waypoint?

cc @louiscryan if you have other thoughts.

[keithmattix]

I can probably tackle/repurpose the L4 authZ policy doc. It may also be helpful to have a doc about how to reason about authorization generally in Ambient

[linsun]

Thanks Keith! Agreed, a doc on understanding authz in general for ambient would be good.

[ilrudie]

Looking into creating something for "Various scenarios on if authz policy is enforces"