add authorization rules, not all yet