add permission control