user/role access validation added