add a permission check