add "refresh their permissions" function