some logging here would be ideal, we raise PermissionDenied in so many ways and places that its hard to track down what the issue was