Authorization rules for RecEvents and UserProfiles