added robust logging for permissions downgrade