that's only the case if you need to pass in dynamic context; the majority of authorization decisions generally do not need them