ensure only members of ou1 can run re