I discovered when working on it that DefaultAuthorizationManager currently belongs to the package org.xwiki.security.authorization making it de facto an API.
IMO that’s a mistake, as this component is an implementation and there’s no reason for it to be an API.
So my proposal is to move it to the package org.xwiki.security.authorization.internal starting in XWiki 17.0.0. This is a breaking API change, but I honestly doubt it would have any impact.
I’m opening this vote for 1 week until thursday 21st of november.
FTR I’m putting the changes on hold for now since @MichaelHamann made good points against my proposed changes and there’s no hurry to perform this move.