better authorization enforcement