fix permission logic