Authorization of hasMany embedded ids