Lane: enforce departments.memberOnly restriction on open rings