it does have authorization with the `allow` and `deny` commands for granular control of who can can see what. Currently very simple, only for email but maybe other fields in the future