protect subuser mgmnt from subusers