add specs for partially-matched permissions