generalize authorization strategy