simplified permissions structure