enable empty action tag (no action, only auth) and specific auth per ressource