Allow for enforcement in post-auth

Which is really where they should be