implemented permissions

still wip