privilege cleanup