is the auth provider not an argument to the rule?