force min of 1 and max of 5 for each request count
update promote/demote process validation
enforce view access by user->is function