use an interface for the permissionEvaluator