make audit independent of authorizers