add permissions to lookup object