Just to verify, we are relying on proper privileges to be setup in the DB and are not explicitly managing permissions in the code?