extended autz with wildcard permissions