new(auth): advanced permission handling