only let container creators add records to a given container