Added support for permission check in controller