sample permission for GET