It'd be nice if the response were configurable, so consuming services could easily be migrated. I can't imagine trying to coordinate authorization checks simply failing at cutover time.