This should use a `RequiredAuthoritiesRepository` that determines which authorities are required given an `Authentication` instance.