Add entitlement-based authN