always use configuration, don't hard code the permission name