add required permissions when running against cmb