requester can only see their own requests, specs wip