use new, simplified permissions