Simple access control, user-entity-relationship