ensure permissions