its true of any relationship-based access control; what, exactly, are you hoping to do?