That's indeed wrong. An AuthorizationService should be stateless.