permissions now apply during update as well