more work on project permissions