don't call permission_check, but pass it to async.apply