I was wrong about the new Authz Core feature having its own API. Not sure where I got that from. All the Authz Core stuff is part of the Management API under the roles and users endpoints.
I haven’t tried this myself, but you can access the management API directly from a rule: