Can only read messages that you sent or messages sent to you ["|", ('to_id.user_id', 'in', [user.id]), ('from_id.user_id', '=', user.id)] Can only modify your user [('user_id', '=', user.id)]