#2 - added permission level constants instead of static string.