code: allow wildcards for permissions