diff --git a/package-lock.json b/package-lock.json
index 663609a..bd236c9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -18737,7 +18737,7 @@
     },
     "packages/user-management": {
       "name": "@digabi/user-management",
-      "version": "0.7.0",
+      "version": "0.7.1-user-management-refactorings.1",
       "license": "EUPL-1.2",
       "dependencies": {
         "@digabi/validation": "^3.1.0",
diff --git a/packages/user-management/__tests__/permissions.test.ts b/packages/user-management/__tests__/permissions.test.ts
index 7e00394..d53f230 100644
--- a/packages/user-management/__tests__/permissions.test.ts
+++ b/packages/user-management/__tests__/permissions.test.ts
@@ -10,7 +10,8 @@ const user: User = {
   ssn: '',
   firstnames: '',
   lastname: '',
-  schools: schoolIds.map(schoolId => ({ schoolId, permissions: [], principal: false, roles: [] }))
+  schools: schoolIds.map(schoolId => ({ schoolId, permissions: [], principal: false, roles: [] })),
+  acceptedEulas: []
 }
 
 describe('Permissions', () => {
diff --git a/packages/user-management/package.json b/packages/user-management/package.json
index 8ad508a..ab1ce2e 100644
--- a/packages/user-management/package.json
+++ b/packages/user-management/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@digabi/user-management",
-  "version": "0.7.0",
+  "version": "0.7.1-user-management-refactorings.1",
   "author": "Matriculation Examination Board, Finland",
   "license": "EUPL-1.2",
   "repository": {
diff --git a/packages/user-management/src/user-checks.ts b/packages/user-management/src/user-checks.ts
index 6b7a315..a5a567e 100644
--- a/packages/user-management/src/user-checks.ts
+++ b/packages/user-management/src/user-checks.ts
@@ -1,22 +1,33 @@
-import { applicationPermissions, AppPerm, Perm, PermissionGrant, PermissionOptions, User, UserSchool } from './index'
+import {
+  applicationPermissions,
+  AppPerm,
+  Perm,
+  PermissionGrant,
+  PermissionOptions,
+  User,
+  UserForAuthentication,
+  UserSchool
+} from './index'
 
-function userSchools(user: User, options?: PermissionOptions): UserSchool[] {
+type UserToCheck = UserForAuthentication | User
+
+function userSchools(user: UserToCheck, options?: PermissionOptions): UserSchool[] {
   return options?.schoolId ? user.schools.filter(school => school.schoolId === options.schoolId) : user.schools
 }
 
-export function userPermissionGrants(user: User, options?: PermissionOptions): PermissionGrant[] {
+export function userPermissionGrants(user: UserToCheck, options?: PermissionOptions): PermissionGrant[] {
   return userSchools(user, options).flatMap(school => school.permissions)
 }
 
-export function userPermissions(user: User, options?: PermissionOptions): Perm[] {
+export function userPermissions(user: UserToCheck, options?: PermissionOptions): Perm[] {
   return userPermissionGrants(user, options).map(grant => grant.permission)
 }
 
-export function isPrincipal(user: User, options?: PermissionOptions): boolean {
+export function isPrincipal(user: UserToCheck, options?: PermissionOptions): boolean {
   return userSchools(user, options).find(school => school.principal) !== undefined
 }
 
-export function hasPermission(user: User, requiredPermission: Perm | '*', options?: PermissionOptions): boolean {
+export function hasPermission(user: UserToCheck, requiredPermission: Perm | '*', options?: PermissionOptions): boolean {
   const principal = isPrincipal(user, options)
   if (principal && !options?.ignorePrincipalRight) {
     return true
@@ -32,7 +43,7 @@ function isApplicationPermission(permission: Perm): permission is AppPerm {
   return applicationPermissions.includes(permission as AppPerm)
 }
 
-export function hasApplicationPermission(user: User, options?: PermissionOptions): boolean {
+export function hasApplicationPermission(user: UserToCheck, options?: PermissionOptions): boolean {
   return (
     isPrincipal(user, options) ||
     userPermissions(user, options).find(permission => isApplicationPermission(permission)) !== undefined
diff --git a/packages/user-management/src/user-types.ts b/packages/user-management/src/user-types.ts
index 7c64ad5..5eba1d4 100644
--- a/packages/user-management/src/user-types.ts
+++ b/packages/user-management/src/user-types.ts
@@ -147,7 +147,8 @@ export const UserSchema = StoredUserDetailsSchema.extend({
   userAccountId: z.string(),
   schools: z.array(UserSchoolSchema),
   censoring: CensoringSchema.optional(),
-  impersonation: z.never().optional()
+  impersonation: z.never().optional(),
+  acceptedEulas: z.array(z.enum(['teacher', 'principal', 'censor']))
 }).strict()
 
 export type UserToUpsert = z.infer<typeof UserToUpsertSchema>
@@ -165,12 +166,19 @@ export const SchoolImpersonationSchema = z
   .object({
     impersonation: ImpersonationSchema,
     ssn: z.literal('IMPERSONATED'),
+    acceptedEulas: z
+      .array(z.string())
+      .max(1, 'only principal eula accepted')
+      .refine(arr => arr.includes('principal'), {
+        message: 'only principal eula accepted'
+      }),
+    censoring: z.undefined(),
     schools: z
       .array(
         z.object({
           schoolId: z.string(),
           principal: z.literal(true),
-          permissions: z.array(z.unknown()).max(0, "Impersonated principal doesn't have other permissions")
+          permissions: z.array(PermissionGrantSchema).max(0, "Impersonated principal doesn't have other permissions")
         })
       )
       .max(1, 'Impersonated principal has one school')