add a basic permissions scheme