add privilege system. still need implementation