permittedRoles -> permissionCheck