add distinct to permission filter