final avatar permissions