add permission routes