shouldn't this be `not (is_enrolled or has_access)`? otherwise, the user has to be enrolled and staff?