add isStaffOrReadOnly permissions