Add a documentation comment that states the business rule (for who is authorised).