authorization spec