enforce sharing permssions on user