add user permission level and ACL and pagination