refining "authorization" design notes