rewrite user access ON RBAC