constrain the scope of the permissions API