Tbh I wouldn’t use languages but rather chainable configurations. Those could be yaml, JSON, toml etc.
I really dislike running any dynamic code for those things. I mean you really only need rbac providers and/or auth providers.
Maybe I underestimate Polkit by a far at the current state, but the 2 times I used it could have been a config file.
X gonna give it to ya