use permission instead of roles for internal OCHA filtering