improve permission logic