permissionmanager: more controls