Users should only be able to perform certain operations based on account permissions