I should have realized this sooner, but this should be secured. It should be sufficient to call `get_course_with_access(..., 'staff')`.