refined export policies and access control for :user