This is intended to complement access control functionality. (Whether or not you can access some records is a related but separate issue from what you're allowed to do with them once you access them. It should be easy for consumers to find out what they can do with what they get.)