Factor out authorization to engine