user dashboard access policy