the enforcement has to be done in your own code currently; we have a planned enterprise feature to build in smarter and configurable security boundaries that would allow this to be done directly