shouldn't specify an hrn when validating credentials for this operation