updated docs about permissions