move this logic to authorization manager.