Apply user permissions