push permissions down into all levels
refactor public data handling