explicitly assign permissions to users