9.2 authorization