relying on the permission IDs seems fragile