rewrite permissions