Should authz be in internal or is there a reason to expose it publicly?