moved ownership and privileged access check to domain object