permissions clarification