apache/casbin ? reverse-engineered prompt

Build me a Go authorization library that makes it easy to control who can do what in an app.

I want it to support the common ways people manage permissions, like simple allow lists, roles, tenant based roles, and rules based on user or resource attributes. It should let me define the access rules in a config style model, load policies from storage, add and remove permissions at runtime, and check access with a simple enforce call.

Please also include support for things like deny rules, rule priority, path based web routes, and helpers for grouping users into roles. If it makes sense, add synced and cached versions, plus a way to plug in persistence and watch for policy changes across multiple instances.

Use the README as the guide for behavior, and if anything is unclear, look up current docs online before coding. Make it clean, well tested, and easy to use from another Go project.