impl user specs for user authorization