also, how is the `user_id` planned to be used in this case?  Not for access control at this layer, right?  So, for logging???