Only by basically embedding the auth provider in the rule, and coupling them super tightly