I am not going to enumerate all the ways this can be abused, but what controls do you have in place?