remove organisation permissions and add profile permissions