starting to use array based permissions