privilege constants instead hard coded strings