simplify the of-user/from-user/to-user mess and add "list-permissions"