hotfix: order permitted_attributes