better permissions handling