more tighten permissions