add permissions to appspec