policy #1: messages can only be read by members