setup controller now reads permissions from file
more work on schema model