RepositoryAccessService.authorize and authorizeById take the optional requesterId every caller had, with read as the default operation, instead of an Actor each caller built the same way. That leaves nine private authorize wrappers in the resource services with nothing to do.