authorization rules and pagination