change auth permission to dynamic