more work on permissions and sharing