add permissions controller