controller spec of permission