use allowy for app event permissions