AuthorizeMessage and other classes in this package look to be immutable. They do not have setter methods. Adding final to the class variables maybe a good practice. Even the class variables like String, UUID are immutable so this is optional, but can be done for consistency sake.