authorization boundary