implement server-side board permission