restrict new assignment permissions
merge