Add tests for user controlled access