add some hierarchical permissions