user doesn't have to post their own privilage level