move permissions into upgrade scripts