make sure we only grant permission if user truly granted the permission