fixed list permissions algo