added permissions model and spec