BlogPostCommentAuthorizer.php

<?php
class BlogPostCommentAuthorizer {
    public function can ($user, $blogPost, $comment) {
        $judge = new Judge;
        
        // blog post owner is obviously allowed to comment for sure
        $policy = new EqualityPolicy();
        $judge->consider($policy->enforce($user->id, $blogPost->getOwner()->id));
    
        // ACL option. the list would generally be put in a separate file/config
        $policy = new ACLPolicy(['mod' => '*', 'user' => 'read, post, edit, delete']); 
        
        // enforce would internally return a Vote class which contains the policy's response to the query
        $judge->consider($policy->enforce($user->getRole(), 'post'));
        
        return $judge->decide();
    }
}