Sorting out who can run what