also verify collective permissions. TODO: add to other functions