(Though you need to perform an access check in the Jelly view, which I guess is already the case, and in any other relevant web methods such as `getApi`.)