           if err or not rels
             return callback err ? new KodingError 'Failed to fetch credentials'
 
+          # if user doesn't have admin roles exclude all the items shared with
+          # the group because regular users do not have rights to list those
           unless 'admin' in roles
             groupId = group.getId()
             rels    = rels.filter (rel) -> not groupId.equals rel.sourceId

  fetchUsers: permit

    advanced: [
      { permission: 'modify credential', superadmin: yes }
      { permission: 'update credential', validateWith: Validators.own }
    ]

    success: (client, callback) ->

    advanced: [
      { permission   : 'update credential', validateWith: Validators.own }
      {
        permission   : 'modify credential'
        validateWith : accessValidator { accessLevel: ACCESSLEVEL.READ }
      }
      { permission   : 'modify credential', superadmin: yes }
    ]
