implement fine-grained access privileges in sus (wip)