initial declarative authorization configuration