sample fix of model add/edit/delete permission on rest api