auth: it's just a list! authorization tends to bring out Strong Opinions ™️ so we decided to try to keep it as simple as possible in the protocol & let the applications build higher-level abstractions give it a read & let me know your thoughts!