LAMBDA-27: migrate permissions