add specs to verify permissions