update README and user docs about permissions