diff --git a/src/apps.js b/src/apps.js
index 2ca28c650..8a934389c 100644
--- a/src/apps.js
+++ b/src/apps.js
@@ -192,6 +192,7 @@ function validateAccessRestriction(accessRestriction) {
 
     if (noUsers && noGroups) return new AppsError(AppsError.BAD_FIELD, 'users and groups array cannot both be empty');
 
+    // TODO: maybe validate if the users and groups actually exist
     return null;
 }