But to me, that doesn't intuitively say I'm creating a new subclass object.

That's why I was suggesting to rename the method to something more readable, like subclass_clone(). Anyway, I agree with Joost about the fact that the authentication stuff should probably reside in an object by its own, whose services are used by your specific manipulation classes.