set up assigned access to restrict local user to one app