secure manager-only functions