allow priviliged entity request without an ID