This should be limited to user stories from a single project probably? Also, check permissions