Should this also check the user's permissions?