learn auth with permissions