permissions check on field update

Adding permissions check
Use `elif`?