Validate that staff has permission to update, pending json response