Authentication is not authorization: verifying high-consequence actions