[PrivateMessage]: check permissions