[PATCH conductor 10/11] restrict hwps retrieved to those user has access to