tighten permissions