Should a user be restricted to using only certain collections or apos?

[jcoyne]

Not too important for internal projects, but might be a concern if opening to outside users.

[andrewjbtw]

I think we definitely want to keep external users to only the collections and/or APOs they are authorized to use.

For internal users, as I understand it (but I could be wrong), the current permissions model in Argo enforces this restriction by allowing them to register items only in the collections/APOs they can access. Since the API includes registration, it will need some way to handle the same permissions.