Ability: change how to check authorization
Ability: change how to check authorization