add security permission to update fucntion