permissions domain hierarchy