setting permissions for viewing staff profiles