fix permission evaluation