refine group and user permissions