can we move all authorization logic to the authorization manager.