Where is the default authorization for the resource defined?