fine tuning permissions