snapshot permission