the system that maintains the authorization rules will have the data about the principal (i.e. if they can edit CA, and view CA and US).