add permission check at manage controller