correct permissions for group access