A list of references to authorization extensions that will be invoked for requests matching this policy. Limited to 1 custom provider.