iteration over users and permissions