change to permission checks to also verify using Vault