needs to merge permissions