making permissions more restrictive