move permissions from db to code