For compatibility reasons, don't we need this to be `auth = ACL.SYSTEM`? Otherwise I think this would cause massive regressions.