add user access control