res.accessLevel should be req.accessLevel