add permission control for actions