more work on permissions