updated authorization rules
slightly better design