tutorial 4 - permissions