add user and permission control