writes are isolated to a certain scope, reads aren't. But I think access control rapidly becomes the most complex thing if you are in a bigger org.