we treat authzed as application-level authz for users of our application - its usage doesn't extend to our development tools