user management based on permission & role