add missing permission check