add comments for authorization rules