diff --git a/bun.lock b/bun.lock
index 427b7077..fe8b9e9d 100644
--- a/bun.lock
+++ b/bun.lock
@@ -235,7 +235,7 @@
     },
     "packages/auth": {
       "name": "@wrnexus/auth",
-      "version": "0.8.15",
+      "version": "0.8.16",
       "dependencies": {
         "@wrnexus/authz": "workspace:*",
         "@wrnexus/captcha": "workspace:*",
@@ -257,7 +257,7 @@
     },
     "packages/authz": {
       "name": "@wrnexus/authz",
-      "version": "0.8.12",
+      "version": "0.8.13",
       "dependencies": {
         "@wrnexus/core": "workspace:*",
         "@wrnexus/db": "workspace:*",
diff --git a/docs/public-api-0.8.json b/docs/public-api-0.8.json
index 6c1f1563..7df93ce1 100644
--- a/docs/public-api-0.8.json
+++ b/docs/public-api-0.8.json
@@ -472,8 +472,6 @@
         "AuthzAuditEvent",
         "AuthzAuditSink",
         "AuthzCatalog",
-        "AuthzConfig",
-        "AuthzIdentityEvent",
         "AuthzModule",
         "AuthzResolver",
         "AuthzResolverOptions",
@@ -499,12 +497,10 @@
         "allow",
         "any",
         "anyDecision",
-        "assignDefaultAuthzRoles",
         "attr",
         "authorize",
         "authorizeDecision",
         "authzMiddleware",
-        "authzPlugin",
         "cachedPermissionStore",
         "can",
         "consoleAuditSink",
@@ -536,14 +532,19 @@
         "requireRole",
         "safeRecord",
         "scopeKey",
-        "setAuthzCatalog",
-        "setDefaultAuthzRoles"
+        "setAuthzCatalog"
       ],
       "./db": [
         "authzMigrationSql",
         "dbPermissionStore",
         "ensureAuthzTables"
       ],
+      "./defaults": [
+        "AuthzIdentityEvent",
+        "assignDefaultAuthzRoles",
+        "setDefaultAuthzRoleStore",
+        "setDefaultAuthzRoles"
+      ],
       "./plugin": [
         "AuthzConfig",
         "authzPlugin",
diff --git a/packages/auth/package.json b/packages/auth/package.json
index 5f751044..4945c420 100644
--- a/packages/auth/package.json
+++ b/packages/auth/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/auth",
-  "version": "0.8.15",
+  "version": "0.8.16",
   "description": "Complete authentication, account security, MFA, passkeys, recovery, devices, risk, and audit system for WRNexusJS.",
   "type": "module",
   "sideEffects": false,
diff --git a/packages/auth/src/http/index.ts b/packages/auth/src/http/index.ts
index e9598ce6..aa1520ea 100644
--- a/packages/auth/src/http/index.ts
+++ b/packages/auth/src/http/index.ts
@@ -11,7 +11,7 @@ import {
 import { resolveAuthSchemas, type AuthSchemaOverrides, type AuthSchemaSet } from "../validation.ts";
 import type { AuthSessionVerificationHandler } from "../types.ts";
 import { completeAuth, startAuth, type OAuthProvider } from "@wrnexus/oauth";
-import { assignDefaultAuthzRoles } from "@wrnexus/authz";
+import { assignDefaultAuthzRoles } from "@wrnexus/authz/defaults";
 
 function text(value: unknown): string {
   return typeof value === "string" ? value : value == null ? "" : String(value);
diff --git a/packages/authz/package.json b/packages/authz/package.json
index d2cf28a4..ffa08cd3 100644
--- a/packages/authz/package.json
+++ b/packages/authz/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/authz",
-  "version": "0.8.12",
+  "version": "0.8.13",
   "private": true,
   "type": "module",
   "main": "src/index.ts",
@@ -8,6 +8,7 @@
     ".": "./src/index.ts",
     "./db": "./src/db.ts",
     "./plugin": "./src/plugin.ts",
+    "./defaults": "./src/defaults.ts",
     "./runtime-middleware": "./src/runtime-middleware.ts",
     "./runtime-memory-middleware": "./src/runtime-memory-middleware.ts"
   },
diff --git a/packages/authz/src/index.ts b/packages/authz/src/index.ts
index 89f0241a..c1c93851 100644
--- a/packages/authz/src/index.ts
+++ b/packages/authz/src/index.ts
@@ -172,7 +172,3 @@ export type {
 } from "./types.ts";
 export type { AuthorizeDecisionOptions } from "./advanced.ts";
 export { generatePermissionTypes } from "./codegen.ts";
-export { authzPlugin } from "./plugin.ts";
-export type { AuthzConfig } from "./plugin.ts";
-export { assignDefaultAuthzRoles, setDefaultAuthzRoles } from "./defaults.ts";
-export type { AuthzIdentityEvent } from "./defaults.ts";