Add permission model and make user access restricted