not really right now besides breaking the permissions into per-subject-type ones