tweak permissions