refactoring; smarter permissions setup