move permission control from rs layer to service layer