Tasks.deny({
    update: function (userId, task, fields) {
        if (PermissionsEnum.Tasks.isNotParticipant(userId, task)) return;
        if (PermissionsEnum.Tasks.isOwner(userId, task)) return;
        return _.contains(fields, "userId");