simplify permission logic by allowing wildcard action permissions