cleaner Hierarchy and authorisation checking, should be faster too