Does overly restrictive access control - not checking group membership yet