note perms in readme