restrict edit permissions