pass a record object (instead of dict) to determine_user_rights