drop overlay requirement in CLE permissions