resource permissions controller