Configuring a protected object policy for additional attribute-based authorization when protecting APIs or a resource using WebSEAL.