diff --git a/apps/emqx_authz/test/emqx_authz_SUITE.erl b/apps/emqx_authz/test/emqx_authz_SUITE.erl
index e62be0aa2..e7b8be54e 100644
--- a/apps/emqx_authz/test/emqx_authz_SUITE.erl
+++ b/apps/emqx_authz/test/emqx_authz_SUITE.erl
@@ -186,7 +186,7 @@ t_move_source(_) ->
                  , #{type := file}
                  ], emqx_authz:lookup()),
 
-    {ok, _} = emqx_authz:move(postgresql, <<"top">>),
+    {ok, _} = emqx_authz:move(postgresql, top),
     ?assertMatch([ #{type := postgresql}
                  , #{type := http}
                  , #{type := mongodb}
@@ -195,7 +195,7 @@ t_move_source(_) ->
                  , #{type := file}
                  ], emqx_authz:lookup()),
 
-    {ok, _} = emqx_authz:move(http, <<"bottom">>),
+    {ok, _} = emqx_authz:move(http, bottom),
     ?assertMatch([ #{type := postgresql}
                  , #{type := mongodb}
                  , #{type := mysql}
@@ -204,7 +204,7 @@ t_move_source(_) ->
                  , #{type := http}
                  ], emqx_authz:lookup()),
 
-    {ok, _} = emqx_authz:move(mysql, #{<<"before">> => postgresql}),
+    {ok, _} = emqx_authz:move(mysql, {before, postgresql}),
     ?assertMatch([ #{type := mysql}
                  , #{type := postgresql}
                  , #{type := mongodb}
@@ -213,7 +213,7 @@ t_move_source(_) ->
                  , #{type := http}
                  ], emqx_authz:lookup()),
 
-    {ok, _} = emqx_authz:move(mongodb, #{<<"after">> => http}),
+    {ok, _} = emqx_authz:move(mongodb, {'after', http}),
     ?assertMatch([ #{type := mysql}
                  , #{type := postgresql}
                  , #{type := redis}
diff --git a/apps/emqx_authz/test/emqx_authz_api_sources_SUITE.erl b/apps/emqx_authz/test/emqx_authz_api_sources_SUITE.erl
index 608090640..4acc38dec 100644
--- a/apps/emqx_authz/test/emqx_authz_api_sources_SUITE.erl
+++ b/apps/emqx_authz/test/emqx_authz_api_sources_SUITE.erl
@@ -336,7 +336,7 @@ t_move_source(_) ->
                  ], emqx_authz:lookup()),
 
     {ok, 204, _} = request(post, uri(["authorization", "sources", "mysql", "move"]),
-                           #{<<"position">> => #{<<"before">> => <<"postgresql">>}}),
+                           #{<<"position">> => <<"before:postgresql">>}),
     ?assertMatch([ #{type := mysql}
                  , #{type := postgresql}
                  , #{type := mongodb}
@@ -345,7 +345,7 @@ t_move_source(_) ->
                  ], emqx_authz:lookup()),
 
     {ok, 204, _} = request(post, uri(["authorization", "sources", "mongodb", "move"]),
-                           #{<<"position">> => #{<<"after">> => <<"http">>}}),
+                           #{<<"position">> => <<"after:http">>}),
     ?assertMatch([ #{type := mysql}
                  , #{type := postgresql}
                  , #{type := redis}