putting in permission checks