commit before tweaking authorization model. I think we can do it with a
[PK,Target-UUID,AuthorizationLevel] 3-tuple