added decorator to implement row-level permissions