forbid all path permissions
merge