simplified permission but scope for groups/users