diff --git a/docs/spec/crosschain/messages.md b/docs/spec/crosschain/messages.md
index 9cc9938109..c74e063ffd 100644
--- a/docs/spec/crosschain/messages.md
+++ b/docs/spec/crosschain/messages.md
@@ -6,6 +6,8 @@ AddToOutTxTracker adds a new record to the outbound transaction tracker.
 only the admin policy account and the observer validators are authorized to broadcast this message without proof.
 If no pending cctx is found, the tracker is removed, if there is an existed tracker with the nonce & chainID.
 
+Authorized: admin policy group 1, observer.
+
 ```proto
 message MsgAddToOutTxTracker {
 	string creator = 1;
@@ -21,7 +23,8 @@ message MsgAddToOutTxTracker {
 ## MsgAddToInTxTracker
 
 AddToInTxTracker adds a new record to the inbound transaction tracker.
-TODO https://github.com/zeta-chain/node/issues/1269
+
+Authorized: admin policy group 1, observer.
 
 ```proto
 message MsgAddToInTxTracker {
@@ -38,7 +41,8 @@ message MsgAddToInTxTracker {
 ## MsgRemoveFromOutTxTracker
 
 RemoveFromOutTxTracker removes a record from the outbound transaction tracker by chain ID and nonce.
-only the admin policy account is authorized to broadcast this message.
+
+Authorized: admin policy group 1.
 
 ```proto
 message MsgRemoveFromOutTxTracker {
@@ -195,6 +199,8 @@ message MsgVoteOnObservedInboundTx {
 WhitelistERC20 deploys a new zrc20, create a foreign coin object for the ERC20
 and emit a crosschain tx to whitelist the ERC20 on the external chain
 
+Authorized: admin policy group 1.
+
 ```proto
 message MsgWhitelistERC20 {
 	string creator = 1;
@@ -209,6 +215,8 @@ message MsgWhitelistERC20 {
 
 ## MsgUpdateTssAddress
 
+Authorized: admin policy group 2.
+
 ```proto
 message MsgUpdateTssAddress {
 	string creator = 1;
@@ -218,6 +226,8 @@ message MsgUpdateTssAddress {
 
 ## MsgMigrateTssFunds
 
+Authorized: admin policy group 2.
+
 ```proto
 message MsgMigrateTssFunds {
 	string creator = 1;
diff --git a/docs/spec/fungible/messages.md b/docs/spec/fungible/messages.md
index 7e77e642df..8b92ef5bad 100644
--- a/docs/spec/fungible/messages.md
+++ b/docs/spec/fungible/messages.md
@@ -4,6 +4,8 @@
 
 DeploySystemContracts deploy new instances of the system contracts
 
+Authorized: admin policy group 2.
+
 ```proto
 message MsgDeploySystemContracts {
 	string creator = 1;
@@ -29,7 +31,7 @@ If this is a non-gas coin, the following happens:
 * ZRC20 contract for the coin is deployed
 * The coin is added to the list of foreign coins in the module's state
 
-Only the admin policy account is authorized to broadcast this message.
+Authorized: admin policy group 2.
 
 ```proto
 message MsgDeployFungibleCoinZRC20 {
@@ -46,9 +48,10 @@ message MsgDeployFungibleCoinZRC20 {
 
 ## MsgRemoveForeignCoin
 
-RemoveForeignCoin removes a coin from the list of foreign coins in the module's state.
+RemoveForeignCoin removes a coin from the list of foreign coins in the
+module's state.
 
-Only the admin policy account is authorized to broadcast this message.
+Authorized: admin policy group 2.
 
 ```proto
 message MsgRemoveForeignCoin {
@@ -59,6 +62,8 @@ message MsgRemoveForeignCoin {
 
 ## MsgUpdateSystemContract
 
+Authorized: admin policy group 2.
+
 ```proto
 message MsgUpdateSystemContract {
 	string creator = 1;
@@ -68,10 +73,13 @@ message MsgUpdateSystemContract {
 
 ## MsgUpdateContractBytecode
 
-UpdateContractBytecode updates the bytecode of a contract from the bytecode of an existing contract
-Only a ZRC20 contract or the WZeta connector contract can be updated
-IMPORTANT: the new contract bytecode must have the same storage layout as the old contract bytecode
-the new contract can add new variable but cannot remove any existing variable
+UpdateContractBytecode updates the bytecode of a contract from the bytecode
+of an existing contract Only a ZRC20 contract or the WZeta connector contract
+can be updated IMPORTANT: the new contract bytecode must have the same
+storage layout as the old contract bytecode the new contract can add new
+variable but cannot remove any existing variable
+
+Authozied: admin policy group 2
 
 ```proto
 message MsgUpdateContractBytecode {
@@ -83,6 +91,8 @@ message MsgUpdateContractBytecode {
 
 ## MsgUpdateZRC20WithdrawFee
 
+Authorized: admin policy group 2.
+
 ```proto
 message MsgUpdateZRC20WithdrawFee {
 	string creator = 1;
@@ -97,6 +107,8 @@ message MsgUpdateZRC20WithdrawFee {
 UpdateZRC20PausedStatus updates the paused status of a ZRC20
 The list of ZRC20s are either paused or unpaused
 
+Authorized: admin policy group 1 (pausing), group 2 (pausing & unpausing)
+
 ```proto
 message MsgUpdateZRC20PausedStatus {
 	string creator = 1;
@@ -109,6 +121,8 @@ message MsgUpdateZRC20PausedStatus {
 
 UpdateZRC20LiquidityCap updates the liquidity cap for a ZRC20 token.
 
+Authorized: admin policy group 2.
+
 ```proto
 message MsgUpdateZRC20LiquidityCap {
 	string creator = 1;
diff --git a/docs/spec/observer/messages.md b/docs/spec/observer/messages.md
index 84b9e4dbd4..66bf781d9a 100644
--- a/docs/spec/observer/messages.md
+++ b/docs/spec/observer/messages.md
@@ -2,6 +2,8 @@
 
 ## MsgAddObserver
 
+Authorized: admin policy group 2.
+
 ```proto
 message MsgAddObserver {
 	string creator = 1;
@@ -13,6 +15,9 @@ message MsgAddObserver {
 
 ## MsgUpdateObserver
 
+Authorized: admin policy group 2 (admin update), old observer address (if the
+reason is that the observer was tombstoned).
+
 ```proto
 message MsgUpdateObserver {
 	string creator = 1;
@@ -52,7 +57,9 @@ message MsgAddBlameVote {
 ## MsgUpdateCrosschainFlags
 
 UpdateCrosschainFlags updates the crosschain related flags.
-Only the admin policy account is authorized to broadcast this message.
+
+Aurthorized: admin policy group 1 (except enabling/disabled
+inbounds/outbounds and gas price increase), admin policy group 2 (all).
 
 ```proto
 message MsgUpdateCrosschainFlags {
@@ -66,9 +73,10 @@ message MsgUpdateCrosschainFlags {
 
 ## MsgUpdateKeygen
 
-UpdateKeygen updates the block height of the keygen and sets the status to "pending keygen".
+UpdateKeygen updates the block height of the keygen and sets the status to
+"pending keygen".
 
-Only the admin policy account is authorized to broadcast this message.
+Authorized: admin policy group 1.
 
 ```proto
 message MsgUpdateKeygen {