permission look up function