extend permission model into mod* and _handler