Yes, I'm not always sure about what is what. The line between business rules and authorization rules seems to be thin/blurred at times to me.