feat(engine): add authorization checking on auths

- now enforce authorizations when modifying authorizations

related to #CAM-979