protected boolean authorize(
Principal principal, List<String> roles, Message message
) throws Exception {
RequestType request = requestBuilder.createRequest(principal, roles, message);
ResponseType response = performRequest(request, message);
ResultType result = response.getResult();
// Handle any Obligations returned by the PDP
handleObligations(request, principal, message, result);
String resource = requestBuilder.getResource(message);