User access control without DBMS