add permission requirements to crm app