Also look at https://github.com/kristallizer/metpetdb-py/blob/api/tests/tastyapi/test_chemical_analyses.py#L68 to add a few more test cases for testing access control. Specifically, `test_user_can_read_unowned_public_chemical_analysis` and `test_user_cannot_read_unowned_private_chemical_analysis`.

Similar test cases can also be added for the update and delete operations. I have to add them for `ChemicalAnalyses` and `Sample`; you can add the same for `Subsample`.