#refs 272 adding permissions