first draft permission privilege (user/role) procedures