improve group permissions