here we can't map just to hostgroup_id because there's n:m relation, Authorizer create will be DRY-ed up later