add base permission control