the former is authz logic, the latter is business logic