Authorization logic should be extracted into a new OpObserver and registered into OpObserverRegistry.