add filter to permissions