Given the same lookup-resources API call, I'd like user b, a group manager, to see both a and b but user a, a group member, to only see user a. This is to "hide" user b from user a.