passing data object to request model, checking for explicit tracks against user permissions