add permissions field, and validate delete permission