Authorization service in CollectionSpace

I have started design for the authorization service in CollectionSpace. While working on security services, I always provide some descriptions on terms used as well as core processes. Take a look at Authorization Service Description and Assumptions for more details about the service. There are some non-trivial requirements that I would like to highlight here.

1. Support multiple tenants from the same service. That is roles and policies/permissions should be tenant-qualified. One tenant's collectionmanager role may not have the same privileges as the other tenant's collectionmanager role.
2. Attribute-level access control. It appears that in the domain of collection management, attribute level access control might be more than uncommon requirement. How to enforce access control at attribute level in search functions so that performance is not degraded drastically is a big challenge.

Indeed, it is not in CollectionSpace's charter to build technology for authorization. So, we looked at a few options including XACML and Spring Security. I have taken rough notes on evaluation. Take a look and let me know if we missed something or have misinterpreted.