Permissions working.

Only return leads they have permission to access