improve permission handling