createdBy field and some basic permissions setup