updated user access control