don't touch db records without permission. And validation that record exists