example app implementing action_permission