user access callback / permission configuration