Lock down CRUD actions per user