add some more permission checking