actually use permissions to manage the module