separate staff access and user access