added spec permissions controller