logic & permission