implement server-side ribbon permission