diff --git a/runtimes/google/ipc/default_authorizer.go b/runtimes/google/ipc/default_authorizer.go
index bbaa7c9..16812e7 100644
--- a/runtimes/google/ipc/default_authorizer.go
+++ b/runtimes/google/ipc/default_authorizer.go
@@ -13,22 +13,29 @@
 
 func (defaultAuthorizer) Authorize(ctx security.Context) error {
 	var (
-		local  = ctx.LocalBlessings().ForContext(ctx)
-		remote = ctx.RemoteBlessings().ForContext(ctx)
+		localForContext  = ctx.LocalBlessings().ForContext(ctx)
+		remote           = ctx.RemoteBlessings()
+		remoteForContext = remote.ForContext(ctx)
 	)
-	// Authorize if any element in local is a "delegate of" (i.e., has been
+	// Authorize if any element in localForContext is a "delegate of" (i.e., has been
 	// blessed by) any element in remote, OR vice-versa.
-	for _, l := range local {
-		if security.BlessingPattern(l).MatchedBy(remote...) {
+	for _, l := range localForContext {
+		if security.BlessingPattern(l).MatchedBy(remoteForContext...) {
 			// l is a delegate of an element in remote.
 			return nil
 		}
 	}
-	for _, r := range remote {
-		if security.BlessingPattern(r).MatchedBy(local...) {
-			// r is a delegate of an element in local.
+	for _, r := range remoteForContext {
+		if security.BlessingPattern(r).MatchedBy(localForContext...) {
+			// r is a delegate of an element in localForContext.
 			return nil
 		}
 	}
-	return fmt.Errorf("policy disallows %v", remote)
+
+	// TODO(ataly, ashankar, caprita): Below we implicitly invoke the String() on
+	// remote blessings in order to construct thre error messsage. This is somewhat
+	// breaking encapsulation as the String() method is hidden from the public API
+	// and is only meant for debugging purposes. Should we make the 'String' method
+	// public?
+	return fmt.Errorf("all valid blessings for this request: %v (out of %v) are disallowed by the policy", remoteForContext, remote)
 }