improve permission checking