revised order of extracting / applying permissions