remove todo
fix: permission hierarchy was the other way around