Allow list values (e.g. users=tinkywinky,dipsy,lala,po).
Warn on access attempt to undefined variables.
I am unfamiliar with have these requirements are covered, but thanks to excellent response from the monks, I have a good starting point for finding the way.