push permissions down into all levels