Dynamic authorizations, carrot style

With IDs

void Main()
{
  var carrotRead = new Authorization<Carrot>(12, Permissions.Read);
	var user = new User();
	user.Authorizations.Add(carrotRead);
	
	if(user.IsAuthorized<Carrot>(12, Permissions.Read))
		"Yeah!".Dump();
	else
		"Boooh!".Dump();
	
}

[Flags] // values must be powers of two
public enum Permissions
{
   Create = 1,
   Read = 2,
   Update = 4,
   Delete = 8
}

public abstract class Auth{
	public int Id{get; set;}
}
public class Authorization<T> : Auth {
	public Authorization(int id, Permissions permissions){ this.Permissions = permissions; this.Id = id; }
	public Permissions Permissions {get;set;}
}

public class Carrot{
	public int Id{get; set;}
}

public class User{
	public User(){ Authorizations = new List<Auth>(); }
	public List<Auth> Authorizations{get; set;}
	public bool IsAuthorized<T>(int id, Permissions permission){
		foreach(var auth in Authorizations)
			if(auth is Authorization<T>){
				var a = auth as Authorization<T>;
				if(a.Permissions == permission && a.Id == id)
					return true;
			}
				
		return false;
	}
}

Without IDs

void Main()
{
	var carrotRead = new Authorization<Carrot>(Permissions.Read);
	var user = new User();
	user.Authorizations.Add(carrotRead);
	
	if(user.IsAuthorized<Carrot>(Permissions.Read))
		"Yeah!".Dump();
	else
		"Boooh!".Dump();
	
}

[Flags] // values must be powers of two
public enum Permissions
{
   Create = 1,
   Read = 2,
   Update = 4,
   Delete = 8
}

public abstract class Auth{

}
public class Authorization<T> : Auth {
	public Authorization(Permissions permissions){ this.Permissions = permissions; }
	public Permissions Permissions {get;set;}
}

public class Carrot{
	public int Id{get; set;}
}

public class User{
	public User(){ Authorizations = new List<Auth>(); }
	public List<Auth> Authorizations{get; set;}
	public bool IsAuthorized<T>(Permissions permission){
		foreach(var auth in Authorizations)
			if(auth is Authorization<T>){
				var a = auth as Authorization<T>;
				if(a.Permissions == permission)
					return true;
			}
				
		return false;
	}
}