correct authorization of delete principal operations