add clarification about inherited vs applied permissions