reduce permissions