navigation: add permissions awareness (ref #8)