more permission changes, update doc