refactored check_permission method