entry resource protected by currentUser policy