add permissions for users in the employees controller