model association and authorization