refine permissions in scripts