encapsulate rest permissions properly