refactored permission checking