authorization bitPermission and wildcardPermission