added missing permission checks