add permission checks for collection schemas