reduced needed permissions from 7 to 3