use canonical location for permission imports