Fix permission-checking logic