added TODO regarding permissions
work orga