minor cleanup
permissions model refined