"A user can always read its own card" false today for external user even if user get right to change his won info