added code to restrict access based on permission level