working on user permissions