user must own or be a member of the group that owns the helper