I think we need to have some unit tests for these internal APIs, just like we have for authz