VG-1231: add permissions