need to check users against permitted list