mapping of permission hierarchy