starting to implement permissions model