[still unmerge-able] User Model & permissibility