up feat administration: add permissions