Use url for the action tuple to avoid 2 permission checks