permissions computation