Get rid of limited access level; move user/group exceptions to read_users/read_groups