I don't think this approach will work; in particular an `authorize` should be both captureable and voidable.