What about when access is not limited, it _is_ about their org but *not* their location? Not sure we have a test for that yet.