Best way to prevent an User to create some kind of record would be checking contentType CREATE and throw an error?