Tightening up runner expectations regarding auth