some user permission specs