add the rule, can't grant without read privilege