restrict d3 to its own entity if not admin