permissions and user association