if you have an implicit level of authz - like they can't authenticate if they're deactivated - you could leave the authz relations in place