make authorize! act on class instance instead of class to create look-ups specific to instance IDs