direct permission editing for users