move auth and hierarchy into sfa/trust