use read_only permissions