more permission refinement