match field filter with permission definition