we don't actually check that the user has access rights to the instance.  the only enforcement is that the requestor has somehow managed to obtain the instance's credentials.  is that adequate?  or should we query CC to verify that the user actually has access to the instance.