Added permission
Added authority check in controller