added guardian as optional requirement, stubbed out object-level permission class