Advanced Authorization in ASP.NET Core

Design and implement a complete authorization strategy in ASP.NET Core using both role-based and policy-based authorization.

The solution should include:

• Role-based access control using [Authorize(Roles = "...")]
• Policy-based authorization using IAuthorizationService
• Custom authorization requirements and handlers to enforce business-specific rules
• Real-world examples such as department-based access, ownership checks, or approval workflows
• Clean, scalable architecture following best practices

Provide working code examples, clear explanations, and recommendations for production-ready applications.