I thought about the same thing and almost removed it. But I thought it would be annoying to be using **Principals**API, then have to include **Authz**Util for this single check. Seems like something PrincipalsAPI could be able to provide for you, as when coding high-level functionality, it's pretty rare that you would otherwise need to touch Authz. The high-level APIs should generally layer over top of Authz, even if they simply delegate to it for some things.