apply permissions recursively