Client can check permission before hand