adoption should require auth