Doesn't make sense to restrict the available cars on backend. A HR user is supposed to know what he does.