separated permission propagation script