fix permission scope