you are right.. separating this 2 questions is big safety advantage. exactly like in software we separate logic from security (like AWS IAM)