Can only read messages from a session where user is [('session_id.user_ids', 'in', user.im_user_id.id)] Can only modify your user [('user_id', '=', user.id)]