distinguish user perm
simplify user perms