Comment by anshumankmr

Ideally I would not let anything in the context which is not authorized for the user or the bot is not authorized to do.