user and player permissions