- allow staff(configurable) and admin to always access the resource
- update requirements