Discussion: Effectiveness of authorization infrastructure