as an alternate/addition to applying per-setting permissions, use the existing VIEW_O...