Tbh I wouldn’t use languages but rather chainable configurations. Those could be yaml, JSON, toml etc.

I really dislike running any dynamic code for those things. I mean you really only need rbac providers and/or auth providers.

Maybe I underestimate Polkit by a far at the current state, but the 2 times I used it could have been a config file.