refactoring of permission logic