#23 implementing permissions in users list