Fix: permission hierarchy was the other way around