Preventing users to directly call unauthorized actions

Regarding to ownership