custom thing permissions