pluggable authorization management