restricting users access to clients?