fixed logic bug in permissions validation