check permission, required if repo runs with more restrictiv security