Tasks.deny({
    update: function (userId, task, fields) {
        if (PermissionsEnum.Tasks.isNotOwner(userId, task)) return;
        return _.contains(fields, "userId");
    }