hack permission control