leave note for the future to think about how to handle wildcard permissions