...
It is the Agent that performs and action therefore Authorizations are checked using Agents. However, they can be created using Resources as well. What's a Resource? Anything you need it to be.
After a few beers, our service architect equates a Resource with an Organization. While it is the Agent that is creating or updating a Hold, authorization has been granted to an Organization (Resource).