Fix: permission hierarchy was the other way around + small fixes