See [Authorization with External Service](https://learn.microsoft.com/en-us/aspnet/core/security/authorization/policies#exs