2. Assign access and permissions with user profiles