Q: access rights for shadowAccount attributes