make permission check protected