chain permission