permissions on json