added permissions

still wip