user permissions for links and actions