if not (user.is_admin or commons.is_workspace_manager(user, workspace)):
            logging.warning('workspace %s not managed by %s, cannot see users', workspace_id, user.ext_id)
            abort(403)