permissions for inventory