auth-based actions