@stilesb if the user does not have a project level role and does not have an account level role then phoenix should not be returning the assets, but these checks might happen if someone was trying to do something sneaky so we want to make sure we catch it, also, Shaun is right, the account level role, if any, should be stored as such so that it can be re-used when the situation occurs again