Add `eligible_objects` and `cls_postconditions`

Check that all objects referred to are allowed to be used by current
user.