Permission checking with userIds