So I want to effectively "delegate" management of a subset of the authz system, so svc A can update everything under its own prefix