you could have a permission `view_with_masking` I ...