they should not be to access anything else except the dashbaord (without edit)