Andya/cohort preview 2

This is a version of #6140, on top of Jim's access control PR.