do we need to check that the user has permission to access both domains or is that handled in one of the sub functions?