add setting contrller, add permission model, working permission mechanism"