new, simplified permissions