authorization over environment model