The new auth code would be easier to work with if most users only dealt with PrincpalName and not with Principal*. AcquiredPrivilege could go away, which would also be good because it tends to end up with references to deleted Princpal objects.