better DSL for permit matching