[permissions] must be used via query