entity collections mapped, authorize() at PolicyFacade implementation has been fixed