add permission checks