permissions in the manifest