permissions hierarchy; ref: #407