Our database has one HROrganization and three legal entities. How do we restrict an actor in Human Resources to be able to see resources assigned to one legal entity only?