add permissions capacity to ControllerGuard