Shouldn't this be checking for `canManage` instead of access?