filter schema by permission; make schema_version read only