createModel now uses permissions