continued on user security model