set up authorization hierarchy