update permission scopes