define a

link

resource and add it as a `viewer`; check based on the link ID if that's how the user was granted access