add sub-permissions on modify