patch features : force user_permission to be the last component invoked