add permission checking