story access permissions