add info about permissions

should've added this long ago