full implementation of create and update on record objects, with associated tests.  Includes authorisation of actions and prevention of third parties modifying each others admin data