so strictly enforcing that reader relations either be all users or only organization#member, should allow that capability, right?