Users only have ssh access when they have the permission :ssh_to_gears.  Have to transactionally handle that.