users are now associated with a privilege