added permissions on entity attributes