BUGFIX: convert PKs to strings for permission checking