working on user privileges