require permission to add MK to CM. also allow removing an MK from CM