Is there an elegant way to get the method that will be executed on a service instance from MessageInspector/AuthorizationPolicy/some other extension point? I could use
Castle WCF integration facility enables you to do just that (among many useful things) by using DynamicProxy proxies. Take a look here.
There's not much documentation on it, so for docs on how to use it it's best to take a look at its tests.