like why is this an authorization concern rather than an authentication concern?