permission control

Change-Id: I7b4ab4b54d22daa3aad0ca5910f867f69aeaa827