private todos - permissions check