check permissions before display fields