add checks to enforce required app permissions